Resubmissions

03-07-2024 22:59

240703-2yn7wszhlp 10

03-07-2024 16:13

240703-tn93lsyglf 10

03-07-2024 16:11

240703-tm84xsyfma 10

10-05-2024 16:25

240510-tw1h5shh47 10

24-08-2023 11:16

230824-nda8msdf8z 10

General

  • Target

    Downloads.rar

  • Size

    184.3MB

  • MD5

    9e3e4dd2eca465797c3a07c0fa2254fe

  • SHA1

    16ceee08c07179157b0fb6de04b7605360f34b20

  • SHA256

    f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

  • SHA512

    f6033af5252203878aa0d1ba77f4816694a953103927362f6308c527e84c61be00816bf9ccba207991f93248ffefaaf31e27f5fd7806d3a4cb35d4104e79f746

Malware Config

Extracted

Family

zloader

Botnet

main

Campaign

26.02.2020

C2

https://airnaa.org/sound.php

https://banog.org/sound.php

https://rayonch.org/sound.php

rc4.plain

Extracted

Family

revengerat

Botnet

XDSDDD

C2

84.91.119.105:333

Mutex

RV_MUTEX-wtZlNApdygPh

Extracted

Family

revengerat

Botnet

Victime

C2

cocohack.dtdns.net:84

Mutex

RV_MUTEX-OKuSAtYBxGgZHx

Extracted

Family

zloader

Botnet

25/03

C2

https://wgyvjbse.pw/milagrecf.php

https://botiq.xyz/milagrecf.php

rc4.plain

Extracted

Family

revengerat

Botnet

samay

C2

shnf-47787.portmap.io:47787

Mutex

RV_MUTEX

Extracted

Family

zloader

Botnet

09/04

C2

https://eoieowo.casa/wp-config.php

https://dcgljuzrb.pw/wp-config.php

rc4.plain

Extracted

Family

zloader

Botnet

07/04

C2

https://xyajbocpggsr.site/wp-config.php

https://ooygvpxrb.pw/wp-config.php

rc4.plain

Extracted

Family

revengerat

Botnet

INSERT-COIN

C2

3.tcp.ngrok.io:24041

Mutex

RV_MUTEX

Extracted

Family

revengerat

Botnet

YT

C2

yukselofficial.duckdns.org:5552

Mutex

RV_MUTEX-WlgZblRvZwfRtNH

Extracted

Family

revengerat

Botnet

system

C2

yj233.e1.luyouxia.net:20645

Mutex

RV_MUTEX-GeVqDyMpzZJHO

Signatures

  • RevengeRat Executable 6 IoCs
  • Revengerat family
  • Zloader family
  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • JavaScript code in executable 3 IoCs
  • NSIS installer 8 IoCs

Files

  • Downloads.rar
    .rar
  • 08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.exe
    .dll windows x86 regsvr32


    Exports

  • 0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
    .exe windows x86


  • 0di3x.exe
    .exe windows x86


  • 201106-9sxjh7tvxj_pw_infected.zip
    .zip

    Password: infected

  • 4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab
    .dll windows x86


  • 2019-09-02_22-41-10.exe
    .exe windows x86


  • 2c01b007729230c415420ad641ad92eb.exe
    .exe windows x86


  • 31.exe
    .exe windows x86


  • 3DMark 11 Advanced Edition.exe
    .exe windows x86


  • 405.zip
    .zip
  • files/alert.jpg
    .jpg
  • files/alertmicrosoft.mp3
  • files/background-2.png
    .png
  • files/microsoft.png
    .png
  • files/style.css
  • files/warning.mp3
  • index.html
    .js
  • msie1.html
    .js
  • msie2.html
    .js
  • 42f972925508a82236e8533567487761.exe
    .exe windows x86


  • 5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    .exe windows x86


  • 6306868794.bin.zip
    .zip

    Password: infected

  • c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286
    .exe windows x86


  • 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
    .exe windows x86


  • 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
    .exe windows x86


  • 948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
    .exe windows x86


  • 95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.exe
    .dll windows x86 regsvr32


    Exports

  • Archive.zip__ccacaxs2tbz2t6ob3e.exe
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • DiskInternals_Uneraser_v5_keygen.exe
    .exe windows x86


  • DoppelPaymer.RANSOM.zip
    .zip

    Password: infected

  • DoppelPaymer.RANSOM
    .exe windows x86


  • E2-20201118_141759.zip
    .zip

    Password: infected

  • f28e02bd1e9cc701437328dc7bec07b439b5b97277a7983e9ca302fbc550e48a.exe
    .exe windows x86


  • E42A.zip
    .zip

    Password: infected

  • E42A
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


    Exports

  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • Endermanch@NavaShield(1).exe
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .msi .vbs
  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


    Exports

  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


    Exports

  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


    Exports

  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • [email protected]
    .exe windows x86


  • Fantom.exe
    .exe windows x86


  • ForceOp 2.8.7 - By RaiSence.exe
    .exe windows x86


  • HYDRA.exe
    .exe windows x86


  • KLwC6vii.exe
    .exe windows x86


  • Keygen.exe
    .exe windows x86


  • Lonelyscreen.1.2.9.keygen.by.Paradox.exe
    .exe windows x86


  • LtHv0O2KZDK4M637.exe
    .exe windows x86


  • Magic_File_v3_keygen_by_KeygenNinja.exe
    .exe windows x86


  • Malware
  • NETFramework.exe
    .exe windows x86


    Exports

  • OnlineInstaller.exe
    .exe windows x86


    Exports

  • REVENGE-RAT.js.zip
    .zip

    Password: infected

  • REVENGE-RAT.js
    .js
  • RRLL.bin.zip
    .zip

    Password: infected

  • RRLL.bin
    .exe windows x86


  • Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
    .exe windows x86


  • [email protected]
    .exe windows x86


  • SecuriteInfo.com.Generic.mg.cde56cf0169830ee.29869
    .dll windows x86


  • SecurityTaskManager_Setup.exe
    .exe windows x86


  • Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
    .exe windows x86


  • VyprVPN.exe
    .exe windows x86


  • WSHSetup[1].exe
    .exe windows x86


  • Yard.dll
    .dll windows x86


    Exports

  • ___ _ _____ __ ___/전산 및 비전산자료 보존 요청서.tgz
    .gz
  • b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (2).exe
    .exe windows x86


    Exports

  • b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (3).exe
    .dll windows x86 regsvr32


    Exports

  • b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb (4).exe
    .dll windows x86 regsvr32


    Exports

  • b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe
    .exe windows x86


  • b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.zip
    .zip
  • cd9ccf8681ed1a5380f8a27cd6dc927ab719b04baa6c6583a0c793a6dc00d5f7.exe
    .exe windows x86


  • cobaltstrike_shellcode.exe
    .exe windows x86


  • cookies.txt
  • css
  • default.exe
    .exe windows x86


  • ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3
    .exe windows x86


  • emotet_exe_e1_ef536781ae8be4b67a7fb8aa562d84994ad250d97d5606115b6f4e6e2992363f_2020-11-17__174504._exe
    .exe windows x86


    Exports

  • emotet_exe_e3_93074e9fbde60e4182f5d763bac7762f2d4e2fcf9baf457b6f12e7696b3562c1_2020-11-17__182823.exe
    .exe windows x86


  • eupdate.exe
    .exe windows x86


  • f4f47c67be61d386e7d757ff89825fa630dd5cc4ed600b5471f9cc18c21e983f.exe
    .exe windows x64


  • fb5d110ced698b06c6cb8c7112792a2d37c579dcd9bde808310cb8dc88e16d9c.exe
    .exe windows x86


  • fee15285c36fa7e28e28c7bb9b4cd3940ef12b9907de59d11ab6e2376416d35.exe
    .exe windows x86


  • file(1).exe
    .exe windows x86


  • file.exe
    .exe windows x86


  • gjMEi6eG.exe
    .exe windows x86


  • good.exe
    .exe windows x86


  • hyundai steel-pipe- job 8010(1).exe
    .exe windows x86


  • hyundai steel-pipe- job 8010.exe
    .exe windows x86


  • infected dot net installer.exe
    .exe windows x86


  • jar.jar
    .jar
  • june9.dll
    .dll windows x86


    Exports

  • mouse_2.exe
    .exe windows x86


  • murphy_chrome.zip
    .zip
  • murphy_ie.zip
    .zip
  • oof.exe
    .exe windows x86


  • openme.exe
    .exe windows x86


  • ou55sg33s_1.exe
    .exe windows x86


  • robots.txt
  • starticon3.exe
    .exe windows x86


  • str.dll
    .dll windows x86


  • svchost.exe
    .exe windows x86


  • update.exe
    .exe windows x86


  • wwf[1].exe
    .exe windows x86


  • xNet.dll
    .dll windows x86


  • 전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요.exe
    .exe windows x86


    Exports

  • 전산 및 비전산자료 보존 요청서(20200525)_꼭 확인하시고 자료보존해주세요1.exe
    .exe windows x86


    Exports